Compliance & security

What we actually check

The evidence behind the posture we report is public: the check catalogue lists every check the product runs across Entra ID and Azure, which public baseline each one stands on (EIDSCA, CISA SCuBA or the Microsoft cloud security benchmark), and which are Basewiser's own work, said so in words. Each check also names the NIS2 Article 21(2) measure its findings help you show evidence for. The page is generated from the product itself, so it cannot fall behind what ships.

Data protection & GDPR

Because the Platform is self-hosted, your organisation is the controller of the data it processes. Basewiser does not receive that data and is not your data processor. If you want us to look at your deployment for support, we agree with you in writing how that is done before we do it. How we handle the personal data we do receive (messages, billing and the install notice) is described in the Privacy Policy.

Sub-processors

The self-hosted model keeps this list short: the portal's findings and your clients' data never leave your Azure. These providers process data for Basewiser:

• Vercel: hosts the website and counts visits, without cookies.
• Brevo: delivers messages from the website's forms to our inbox.
• Microsoft: our email (Microsoft 365), and the Azure service that receives the one-time install notice and requests portal DNS records.
• Stripe: payments and invoices.
• Cloudflare: DNS for basewiser.com, and hosting of the demo and the setup page.

Your deployment also talks directly to Microsoft (to read your tenants), GitHub (to download releases and check for updates) and Stripe (for billing). Those connections go from your Azure to those services, not through Basewiser.

We will post material changes to this list here and, where required, give notice before adding a new sub-processor.

Hosting & infrastructure

The Platform is delivered as Azure-native services you deploy in your subscription. It uses a managed identity, and its secrets are stored in your own Azure resources. After setup it sends no portal data to Basewiser: it contacts GitHub to check for updates and Stripe for billing. Updates are published as pinned releases you choose to roll out.

No AI in the product

Every finding, number and sentence in the portal comes from checks Basewiser authored and from your tenants' own data. No AI service is used, inside or outside your deployment, and nothing from your tenants is sent to one.

Security practices

• Read-only access to each connected tenant, granted by that tenant's own admin. No write permissions are requested.
• Secrets are stored in your own Azure resources. Basewiser stores no secrets that give access to your environment.
• Every update is a pinned, versioned release you choose to install.
• Data is encrypted in transit, and at rest by your own Azure storage.
• Every Conditional Access change the portal detects is logged.

Certifications & attestations

Basewiser does not hold SOC 2 or ISO 27001 certification today. Because the Platform runs in your own Azure and Basewiser holds no standing access to your data, most of what such an audit covers for a hosted product does not apply. Azure's certifications cover Microsoft's platform, not Basewiser. Any formal certification will be listed here once it exists.

Responsible disclosure

To report a security issue, email security@basewiser.com. Reports are acknowledged within three business days, and you are kept updated until the issue is resolved. Please allow reasonable time to resolve it before you publish details.

Security questionnaires

For a security questionnaire or anything this page does not answer, email contact@basewiser.com or use the contact form.